Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Why Phishing Works

This article was originally published in Professional Security Magazine. Why are organizations still losing to phishing in 2026? Phishing has been the dominant attack vector for years. Despite this, organizations continue to be caught out by it. The UK government’s Cyber Security Breaches Survey 2026 confirms it remains the most prevalent and disruptive type of attack that businesses are facing. For those on the front line of incident response investigations globally, that finding is no surprise.

AI Alone Won't Stop the Breach: Why Email Security Needs Humans-on-the-Loop

2026 has officially become the year of speed, scale and support. The delta between a phishing email landing and a full organizational compromise has shrunk to mere seconds. The reality by the numbers: To close this window, your defense strategy must evolve into a two-step strategy of accuracy and automation.

Phishing Campaign Exploits Google AppSheets to Target Facebook Accounts

Researchers at Guardo Labs are tracking a major phishing campaign that abused Google AppSheet as a relay to send phishing emails. The researchers identified more than 30,000 Facebook accounts that were compromised by this campaign. Since the emails are sent from Google’s legitimate infrastructure, they’re much more likely to land in users' inboxes.

Warning: Phishing Attacks Are Abusing the Kuse AI App

Attackers are abusing the storage and sharing features of Kuse, a free AI app, to assist in phishing campaigns, according to researchers at Trend Micro. Kuse is a legitimate agentic AI platform used by employees to streamline workflows. Users can share files with coworkers, which generates a link hosted by Kuse’s domain. In this case, attackers are abusing the share feature to generate legitimate-looking phishing links.

Sophos Email: Enterprise-grade, AI-powered email protection

Sophos Email delivers enterprise-grade protection that keeps malicious messages out of user inboxes, elevates your defense against AI-powered adversaries, trains your employees to stay vigilant, and simplifies day-to-day security operations - all at a competitive price point.

New RMM Abuse Exposes Remote Access Blind Spots in U.S. and EU Companies

Can your SOC prove when a trusted remote access tool becomes unauthorized access? That is the challenge behind the latest RMM abuse targeting companies in the U.S. and Europe. Attackers are using phishing pages to deliver legitimate remote access software, making malicious activity look like routine IT work. For CISOs, the risk is clear: if the team cannot see how the tool entered the environment, what executed, and where the connection went next, containment slows down and business exposure grows.

LuxSci Launches Enterprise-Grade HIPAA-Compliant Email Security for Mid-Sized Healthcare Organizations

New right-sized offering brings advanced encryption, easy API integration, and HITRUST-certified compliance to the most underserved segment in healthcare email - with pricing starting at $99/month.

Why Your Email Security Needs a Global Human Network to Close the Detection Gap

The biggest challenge in email security today isn’t just detecting a threat; it’s the speed of response across a global landscape. As we head into the second half of 2026, the stakes with speed have gotten higher. According to SQ Magazine, AI-generated phishing attempts are 68% harder to detect than they were just a year ago, and the average cost of an AI-powered breach has climbed to $5.72 million. Cybercriminals are using the same AI you are to bypass your filters.